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Amended Claim Schedule 



1 Claims 1-24 have been cancelled previously. 
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25. (Currently Amended) A method of issuing an electronic negotiable document (END) 
comprising: creating as data an END and storing this in a tamper-resistant document car- 
rier, the document carrier containing a unique public-secret key pair for signing and veri- 
fying, th e s e cr e t k e y b e ing g e n e rat e d within th e docum e nt carri e r , and a unique document 
carrier identifier; signing the unique document-carrier identifier, the END and an END 
identifier using the secret key of the public-secret key pair, and storing the result in the 
document carrier. 

26. (Previously Presented) A method according to Claim 25 of issuing an END, further 
comprising generating a time stamp representing the time of issue and storing this with 
the END in the tamper-resistant document carrier before the encryption step. 

27. (Previously Presented) A method according to Claim 25 of issuing an END, includ- 
ing the step of calculating a hash value of the END and/or the time stamp value and stor- 
ing this hash value instead of the full END in the tamper-resistant document carrier, be- 
fore the said encryption step. 
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1 28. (Previously Presented) A method according to Claim 25 of issuing an END, in which 

2 the document carrier identifier is a device number and the END identifier is a serial num- 

3 ber. 

1 29. (Previously Presented) A method according to claim 25 of issuing an END, in which 

2 the END identifier is supplemented with data representing a water mark unique to the is- 

3 suer. 

1 30. (Previously Presented) A method according to claim 25 of issuing an END, com- 

2 prising the step of calculating a hash value of the data to be encrypted by said secret key, 

3 in place of the full data. 

1 31. (Previously Presented) A method according to claim 25 of issuing an END, in which 

2 the document carrier stores a negotiability status flag indicative of whether the END 

3 stored therein in negotiable or non-negotiable, and including the step of setting the flag to 

4 "negotiable" after the result of the encryption has been stored in the document carrier. 

1 32. (Previously Presented) A method according to claim 25 of issuing an END, in which 

2 the document carrier includes a counter for counting a serial number, indicative of the 

3 number of times that the END has been negotiated since issue, and comprising the step of 

4 setting the counter to zero after the result of the encryption has been stored in the docu- 

5 ment carrier. 

1 33. (Previously Presented) A tamper-resistant document carrier adapted to store an END 

2 in accordance with the method of claim 25, comprising read only software for controlling 

3 the steps of storing the END, encrypting the END and other data with the pre-stored se- 

4 cret key, and storing the result in a memory. 
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1 34. (Previously Presented) A document carrier according to Claim 33, in which the 

2 memory includes a negotiability status flag capable of being set either to "negotiable" or 

3 to "non-negotiable 1 . 

1 35. (Previously Presented) A document carrier according to Claim 33, in which the 

2 memory includes a counter for storing a serial number representative of the number of 

3 times the END has been negotiated. 

1 36. (Currently Amended) A method of negotiating an END between a seller and a buyer 

2 each possessing a tamper-resistant document carrier having its own public-secret key 

3 pair, in which the END is stored in the seller's document carrier in the form of END data, 

4 and the signature generated by the secret signing-key of a document carrier of the issuer 

5 of the END, together with a negotiability status flag indicative of whether the END is 

6 currently negotiable from the document carrier on which it is stored, comprising estab- 

7 lishing mutual recognition and v e rification between the seller and buyer using one or 

8 more predetermined protocols between the respective document carriers; verifying in the 

9 sellers document carrier that the negotiability status flag is "negotiable" and aborting the 

10 negotiation if not; sending the public encryption key of the buyer's document carrier to 
i i the seller's document carrier, and using it to encrypt the message comprising the END 

12 together with the negotiability status flag; sending that encrypted message to the buyer; 

13 decrypting that message using the buyer's secret decryption key, and setting the negotia- 

14 bility status flag for that END of the buyer's and seller's document carriers respectively to 
is "non n e gotiabl e " "negotiable" and "n e gotiabl e " " non-negotiable" . 

1 37. (Currently Amended) A method of negotiating an END between a seller and, a buyer 

2 each possessing a tamper-resistant document carrier having its own public-secret key 

3 pair, in which the END is stored in the seller's document carrier in the form of END data, 

4 and the signature generated by the secret signing key of a document carrier of the issuer 

5 of the END, together with a serial number counter indicative of the number of times that 

6 the END has been negotiated since issue, comprising establishing mutual recognition and 
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7 v e rification between seller and buyer using one or more predetermined protocols between 

8 the respective document carriers; verifying in the seller's document carrier that the END, 

9 if it has been stored previously in that document carrier, has a different counter value this 

10 time and is therefore negotiable; sending the public encryption key of the buyer's docu- 
n ment carrier to the seller's document carrier, and using it to encrypt the message com- 

12 prising the END together with the counter; sending that encrypted message to the buyer; 

13 decrypting that message using the buyer's secret decryption key, and incrementing the 

14 counter by one. 

1 38. (Previously Presented) A method according to Claim 36, in which each document 

2 carrier is installed originally with a certificate comprising a digital signature of its unique 

3 identifier and of its public key. 

1 39. (Previously Presented) A method according to Claim 37, in which each document 

2 carrier is in- stalled originally with a certificate comprising a digital signature of its 

3 unique identifier and of its public key. 

1 40. (Previously Presented) A method according to Claim 38, in which the certificate 

2 unique to the document carrier on which the END was originally issued is stored with the 

3 END in the seller's document carrier. 

1 41 . (Previously Presented) A method according to Claim 39, in which the certificate 

2 unique to the document carrier on which the END was originally issued is stored with the 

3 END in the seller's document carrier. 

1 42. (Previously Presented) A method according to Claim 38, in which the certificate of 

2 the buyer's document carrier is sent to the seller's document carrier in which it is authen- 

3 ticated and the negotiation is aborted if authentication fails. 
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1 43. (Previously Presented) A method according to Claim 39, in which the certificate of 

2 the buyer's document carrier is sent to the seller's document carrier in which it is authen- 

3 ticated and the negotiation is aborted if authentication fails. 

1 44. (Previously Presented) A method according to Claim 36, in which the buyer's docu- 

2 ment carrier, after decrypting the message using its secret key, verifies the signature of 

3 the issuer on the END, and informs the issuer in the event that authentication fails. 

1 45. (Previously Presented) A method according to Claim 37, in which the buyer's docu- 

2 ment carrier, after decrypting the message using its secret key, verifies the signature of 

3 the issuer on the END, and informs the issuer in the event that authentication fails. 

1 46. (Previously Presented) A method according to Claim 25, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public-secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing-key of a document carrier of the 

6 issuer of the END, together with a negotiability status flag indicative of whether the END 

7 is currently negotiable from the document carrier on which it is stored, comprising estab- 

8 lishing mutual recognition between the seller and buyer using a predetermined protocol 

9 between the respective document carriers; verifying in the seller's document carrier that 

10 the negotiability status flag is "negotiable" and aborting the negotiation if not; sending 

i i the public encryption key of the buyer's document carrier to the seller's document carrier, 

12 and using it to encrypt the message comprising the END together with the negotiability 

13 status flag; sending that encrypted message to the buyer; decrypting that message using 
H the buyer's secret decryption key, and setting the negotiability status flag for that END of 
is the buyer's and seller's document carriers respectively to "non-negotiable" and "negotia- 
te ble". 
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1 47. (Previously Presented) A method according to Claim 25, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing key of a document carrier of the 

6 issuer of the END, together with a serial number counter indicative of the number of 

7 times that the END has been negotiated since issue, comprising establishing mutual rec- 

8 ognition between seller and buyer using a predetermined protocol between their respec- 

9 tive document carriers; verifying in the seller's document carrier that the END, if it has 

10 been stored, previously in that document carrier, has a different counter value this time 

i i and is therefore negotiable, but aborting the negotiation if it is not negotiable; sending the 

12 public encryption key of the buyer's document carrier to the seller's document carrier, and 

13 using it to encrypt the message comprising the END together with the counter; sending 

14 that encrypted message to the buyer; decrypting that message using the buyer's secret de- 
ls cryption key, and incrementing the counter by one. 

1 48. (Previously Presented) A method according to Claim 26, of issuing and END on a 

2 document- carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public-secret 

4 key pair, in which the END is stored in the seller' s document carrier in the form of END 

5 data, and the signature generated by the secret signing-key of a document carrier of the 

6 issuer of the END, together with a negotiability status flag indicative of whether the END 

7 is currently negotiable from the document carrier on which it is stored, comprising estab- 

8 lishing mutual recognition between the seller and buyer using a predetermined protocol 

9 between the respective document carriers; verifying in the seller' s document carrier 'that 

10 the negotiability status flag is "negotiable" and aborting the negotiation if not; sending 

i i the public encryption key of the buyer's document carrier to the seller's document carrier, 

12 and using it to encrypt the message comprising the END together with the negotiability 

B status flag; sending that encrypted message to the buyer; decrypting that message using 

H the buyer's secret decryption key, and setting the negotiability status flag for that END of 
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15 the buyer's and seller's document carriers respectively to "non-negotiable" and "negotia- 



1 49. (Previously Presented) A method according to Claim 26, of issuing an END on a 

2 document-carrier followed by a method of negotiating an END between a seller and a 

3 buyer each possessing a tamper-resistant document carrier having its own public secret 

4 key pair, in which the END is stored in the seller's document carrier in the form of END 

5 data, and the signature generated by the secret signing key of a document carrier of the 

6 issuer of the END, together with a serial number counter indicative of the number of 

7 times that the END has been negotiated since issue, comprising establishing mutual rec- 

8 ognition between seller and buyer using a predetermined protocol between their respec- 

9 tive document carriers; verifying in the seller's document carrier that the END, if it has 

10 been stored previously in that document carrier, has a different counter value this time 

i i and is therefore negotiable, but aborting the negotiation if it is not negotiable; sending the 

12 public encryption key of the buyer's document carrier to the seller's document carrier, and 

13 using it to encrypt the message comprising the END together with the counter; sending 

14 that encrypted message to the buyer; decrypting that message using the buyer's secret de- 
is cryption key, and incrementing the counter by one. 

1 50. (Currently Amended) A method according to Claim 48, in which the buyer's docu- 

2 ment carrier, after decrypting the message with its secret key, verifies that the END is 

3 still valid by taking its time stamp, and, if it has expired, informs the issuer of this, and 

4 aborts the negotiation before impl e m e nting incrementing the counter or setting the nego- 

5 tiation status flag. 

1 51. (Currently Amended) A method according to Claim 49, in which the buyer's docu- 

2 ment carrier, after decrypting the message with its secret key, verifies that the END is 

3 still valid by taking its time stamp, and, if it has expired, informs the issuer of this, and 

4 aborts the negotiation before impl e m e nting incrementing the counter or setting the nego- 

5 tiation status flag. 
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1 52. (Previously Presented) A method according to Claim 36, including recovering the 

2 negotiation of an END which has previously broken down, by providing the buyer's 

3 document-carrier with the necessary secret key which has been reproduced by the issuer 

4 or by a trusted third party. 

1 53. (Previously Presented) A method according to Claim 37, including recovering the 

2 negotiation of an END which has previously broken down, by providing the buyer's 

3 document-carrier with the necessary secret key which has been reproduced by the issuer 

4 or by a trusted third party. 

1 54. (Previously Presented) A method according to Claim 36, including recovering an 

2 END lost from a primary document-carrier, by activating a back-up document-carrier 

3 "which has previously been provided with back-up data reproduced from the primary 

4 document-carrier. 

1 55. (Previously Presented) A method according to Claim 37, including recovering an 

2 END lost from a primary document-carrier, by activating a back-up document-carrier 

3 which has previously been provided with back-up data reproduced from the primary 

4 document-carrier. 

1 56. (Previously Presented) A method according to Claim 52, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 57. (Previously Presented) A method according to Claim 53, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 

1 58. (Previously Presented) A method according to Claim 54, comprising inhibiting the 

2 recovery until the expiry of the predetermined period of validity of the END. 
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59. (Previously Presented) A method according to Claim 55, comprising inhibiting the 
recovery until the expiry of the predetermined period of validity of the END. 

60. (Currently Amended) A method of negotiating an END, sold by a seller to a buyer, in 
which the buyer splits the END electronically into two or more parts and then negotiates 
those parts separately to one or more further buyers , wh e r e in th e total valu e r e presented 
by all parts r e mains th e sam e as th e valu e of th e END . 

61 . (Previously Presented) A method according to Claim 60, in which each part is sub- 
jected to the digital signature of the said buyer's document carrier which effects the split- 
ting. 
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